CVE-2021-21317CWE-400

Denial of Service in uap-core

Medium · published February 16, 2021

CVSS v3.1
5.3
EPSS
3%
Percentile
84.7
In the wild
Unconfirmed
What it is

uap-core in an open-source npm package which contains the core of BrowserScope's original user agent string parser. In uap-core before version 0.11.0, some regexes are vulnerable to regular expression denial of service (REDoS) due to overlapping capture groups. This allows remote attackers to overload a server by setting the User-Agent header in an HTTP(S) request to maliciously crafted long strings. This is fixed in version 0.11.0. Downstream packages such as uap-python, uap-ruby etc which depend upon uap-core follow different version schemes.

The record
Technical detail
CVSS v3.1
5.3 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.02517 · 84.7th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2021-02-16T17:45Z
EPSS history
Timeline
  • 16 FEB 17:45Z
    Denial of Service in uap-core
    cvelistv5